Cyber Incident Victim: Ukrainian Soldiers
Date:
Jan 2017
Location:
Ukraine
Summary
Ukrainian soldiers fighting in eastern Ukraine were targeted with threatening and demoralizing text messages designed to appear as internal communications, urging desertion and spreading disinformation. The messages, delivered via cell site simulators mimicking legitimate cell towers, were part of a propaganda campaign with evidence pointing to Russian involvement, including the use of specialized electronic warfare systems. While many troops dismissed the messages as insignificant, the persistent psychological pressure exacerbated stress among personnel already enduring prolonged combat conditions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Ukrainian soldiers fighting pro-Russian separatists in eastern Ukraine began receiving threatening and demoralizing text messages in 2014, shortly after the conflict erupted. These messages targeted troops near front-line positions, with documented incidents occurring in locations such as Avdiivka in January 2017 and Debaltseve in 2015. The texts contained content designed to undermine morale, including warnings like "they'll find your bodies when the snow melts," false claims of commanders deserting, and suggestions that soldiers were being sacrificed as "cannon fodder." Many messages were disguised as originating from fellow Ukrainian servicemembers. The Associated Press documented nearly four dozen such messages sent between 2014-2017, with soldiers reporting regular receipt of these communications during active combat situations. Television journalist Julia Kirienko witnessed soldiers receiving identical simultaneous texts while under shelling near Donetsk in early 2017.
Investigations by Ukrainian telecommunications companies and cybersecurity experts determined the messages were transmitted using cell site simulators – surveillance devices that impersonate legitimate cell towers to intercept or manipulate mobile communications. Ukraine's national cyberpolice unit confirmed the ongoing use of "fake towers" by Russian-aligned forces, with evidence pointing specifically to the Russian LEER-3 electronic warfare system observed in Donetsk and Luhansk. The LEER-3 system, described in Russian military publications, utilizes drone-mounted technology capable of hijacking up to 2,000 cell connections simultaneously across a 6-kilometer radius. While Ukrainian military intelligence acknowledged the cell site simulator attacks, they declined official comment on operational impacts. Soldier reactions varied, with some dismissing the messages as ineffective psychological operations while others reported cumulative psychological strain from the persistent threats combined with combat fatigue. Volunteer workers observed that the regularity of messages exacerbated war-weariness among troops experiencing heavy casualties in a conflict that had claimed over 9,900 lives by 2017.